topic chart command has reached the limit for data points in Splunk Search

chart command has reached the limit for data points

cramasta — Mon, 26 Mar 2012 14:13:13 GMT

Does anyone know if this is something that can be adjusted in the limits.conf file?
[subsearch]: chart command has reached the limit for data points. Results may be incomplete

Re: chart command has reached the limit for data points

sowings — Mon, 26 Mar 2012 14:45:12 GMT

Yes, you can change the subsearch limit in limits.conf, but I've only rarely found a need to do so. It may not be necessary, depending upon what you're trying to do. Can you provide an example of what you're trying to do?

Re: chart command has reached the limit for data points

cramasta — Mon, 26 Mar 2012 15:44:04 GMT

I am using the following search over 30 days. I believe it may have something to do with using the OVER function in the chart command.

...| chart values(cpiduration) AS WebCallPerformance values(Status) AS WebCallStatus over RequestID by webservice

what setting in the limits.conf do you think i can adjust to fix this?

Re: chart command has reached the limit for data points

sowings — Tue, 27 Mar 2012 15:19:03 GMT

The limits.conf stanza in question is [subsearch], but remember to create this setting in a "local" version of limits.conf, as changes to the version in the default directory may be overwritten at upgrade time.

Re: chart command has reached the limit for data points

cramasta — Wed, 28 Mar 2012 13:44:49 GMT

what setting would you be referring to? maxout?

Re: chart command has reached the limit for data points

sowings — Wed, 28 Mar 2012 13:52:53 GMT

Yes, that's the one. The default in 4.3.1 is 10,000, not 100 as indicated in limits.conf.spec.

Re: chart command has reached the limit for data points

cramasta — Wed, 28 Mar 2012 14:20:51 GMT

So initially i was running this chart command in a sub-search. If I run it by itself as a single search I still get the same error without the sub-search piece being mentioned. I'm thinking there may be a different setting that would have to be adjusted specifically for the chart command (if its even something that can be changed).

chart command has reached the limit for data points. Results may be incomplete.

Re: chart command has reached the limit for data points

sowings — Wed, 28 Mar 2012 18:22:25 GMT

I don't see anything in limits.conf that specifically says "I'm the limit for chart". Instead, I might rephrase the question as "what problem are you trying to solve?"

I wonder whether the "over RequestID" as the "split by" clause combined with the "by webservice" phrase are producing a matrix that is too large for chart to handle comfortably.

Simply put, adjusting limits.conf may not be the answer.

Re: chart command has reached the limit for data points

cramasta — Wed, 28 Mar 2012 18:24:57 GMT

Im going to open a support case to find out what limitations of the chart command are causing this warning

Re: chart command has reached the limit for data points

tzhmaba2 — Tue, 03 Apr 2012 14:25:30 GMT

Could you post the answer from the support here?
Thanks!

Re: chart command has reached the limit for data points

araitz — Thu, 19 Apr 2012 03:42:37 GMT

Was there an answer?

Re: chart command has reached the limit for data points

nekb1958 — Wed, 05 Sep 2012 22:06:19 GMT

Was there any answer from support, i got the same error (without a subsearch) and want to fix it. Thank you.